Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 07:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe
Resource
win7-20240708-en
7 signatures
120 seconds
General
-
Target
793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe
-
Size
454KB
-
MD5
da76b6e9aaf490136483720361a13bc0
-
SHA1
c3b189afd2f3defe6c268d08c527a4d325894304
-
SHA256
793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2
-
SHA512
5d3b603c0d50d2af35d47333ffa6af6450bff09d9e56d6cb15d91aa39061b274fac13c3909162020f4e2d064688c9cbd45b14f1f2a502bd4146a4d75cdd28fd8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3392-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/344-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/424-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-1731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-1838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1356 hnbbtn.exe 4580 xfrlffx.exe 4196 flxrlff.exe 540 rxrrllf.exe 344 tnnnbt.exe 432 fxlfrrl.exe 1896 tntnnn.exe 1884 3rxxffl.exe 216 tbhhhb.exe 1780 xfrlrlr.exe 4404 jdpjp.exe 4484 frxrffx.exe 1636 nbhhbh.exe 4488 ppddd.exe 1492 hbhhnn.exe 4344 vppdv.exe 1764 9thnht.exe 3636 vpdvp.exe 4584 ddddp.exe 3012 bhnhbb.exe 4724 nnnhtt.exe 5084 jvjdv.exe 5012 5rxrllf.exe 2620 bhhnhh.exe 4056 5vdvj.exe 4892 ntbtnn.exe 3144 llfxrlf.exe 4792 tbnhbt.exe 444 rlfrfxl.exe 4700 dvddv.exe 4220 lfllffx.exe 912 dpvpv.exe 424 7rxlllr.exe 224 tbhhnn.exe 2876 ppvpj.exe 4540 rrfxrrl.exe 4464 9thhbt.exe 1304 xrxlfxr.exe 4508 tbntbh.exe 1716 pdjdd.exe 1532 pvjdp.exe 2232 xxxrrlf.exe 3568 7tnhhb.exe 3756 pjpjp.exe 4420 lllxrrf.exe 2356 rfrlffx.exe 4560 tntttb.exe 1384 dpppv.exe 1528 xlrfxrl.exe 3004 flrlxrl.exe 4504 btnbnb.exe 4084 1pjdp.exe 2148 3lfxllf.exe 3656 7lrflff.exe 3112 3tbtht.exe 2164 pjvjp.exe 2020 xxlfxrl.exe 1592 nbbnth.exe 4836 httnhb.exe 2776 1vjjv.exe 1248 fxxrfxf.exe 3924 5tnhtt.exe 1868 hbbthh.exe 1764 jdjdd.exe -
resource yara_rule behavioral2/memory/3392-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/344-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/424-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-735-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3392 wrote to memory of 1356 3392 793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe 83 PID 3392 wrote to memory of 1356 3392 793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe 83 PID 3392 wrote to memory of 1356 3392 793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe 83 PID 1356 wrote to memory of 4580 1356 hnbbtn.exe 84 PID 1356 wrote to memory of 4580 1356 hnbbtn.exe 84 PID 1356 wrote to memory of 4580 1356 hnbbtn.exe 84 PID 4580 wrote to memory of 4196 4580 xfrlffx.exe 85 PID 4580 wrote to memory of 4196 4580 xfrlffx.exe 85 PID 4580 wrote to memory of 4196 4580 xfrlffx.exe 85 PID 4196 wrote to memory of 540 4196 flxrlff.exe 86 PID 4196 wrote to memory of 540 4196 flxrlff.exe 86 PID 4196 wrote to memory of 540 4196 flxrlff.exe 86 PID 540 wrote to memory of 344 540 rxrrllf.exe 87 PID 540 wrote to memory of 344 540 rxrrllf.exe 87 PID 540 wrote to memory of 344 540 rxrrllf.exe 87 PID 344 wrote to memory of 432 344 tnnnbt.exe 88 PID 344 wrote to memory of 432 344 tnnnbt.exe 88 PID 344 wrote to memory of 432 344 tnnnbt.exe 88 PID 432 wrote to memory of 1896 432 fxlfrrl.exe 89 PID 432 wrote to memory of 1896 432 fxlfrrl.exe 89 PID 432 wrote to memory of 1896 432 fxlfrrl.exe 89 PID 1896 wrote to memory of 1884 1896 tntnnn.exe 90 PID 1896 wrote to memory of 1884 1896 tntnnn.exe 90 PID 1896 wrote to memory of 1884 1896 tntnnn.exe 90 PID 1884 wrote to memory of 216 1884 3rxxffl.exe 91 PID 1884 wrote to memory of 216 1884 3rxxffl.exe 91 PID 1884 wrote to memory of 216 1884 3rxxffl.exe 91 PID 216 wrote to memory of 1780 216 tbhhhb.exe 92 PID 216 wrote to memory of 1780 216 tbhhhb.exe 92 PID 216 wrote to memory of 1780 216 tbhhhb.exe 92 PID 1780 wrote to memory of 4404 1780 xfrlrlr.exe 93 PID 1780 wrote to memory of 4404 1780 xfrlrlr.exe 93 PID 1780 wrote to memory of 4404 1780 xfrlrlr.exe 93 PID 4404 wrote to memory of 4484 4404 jdpjp.exe 94 PID 4404 wrote to memory of 4484 4404 jdpjp.exe 94 PID 4404 wrote to memory of 4484 4404 jdpjp.exe 94 PID 4484 wrote to memory of 1636 4484 frxrffx.exe 95 PID 4484 wrote to memory of 1636 4484 frxrffx.exe 95 PID 4484 wrote to memory of 1636 4484 frxrffx.exe 95 PID 1636 wrote to memory of 4488 1636 nbhhbh.exe 96 PID 1636 wrote to memory of 4488 1636 nbhhbh.exe 96 PID 1636 wrote to memory of 4488 1636 nbhhbh.exe 96 PID 4488 wrote to memory of 1492 4488 ppddd.exe 97 PID 4488 wrote to memory of 1492 4488 ppddd.exe 97 PID 4488 wrote to memory of 1492 4488 ppddd.exe 97 PID 1492 wrote to memory of 4344 1492 hbhhnn.exe 98 PID 1492 wrote to memory of 4344 1492 hbhhnn.exe 98 PID 1492 wrote to memory of 4344 1492 hbhhnn.exe 98 PID 4344 wrote to memory of 1764 4344 vppdv.exe 99 PID 4344 wrote to memory of 1764 4344 vppdv.exe 99 PID 4344 wrote to memory of 1764 4344 vppdv.exe 99 PID 1764 wrote to memory of 3636 1764 9thnht.exe 100 PID 1764 wrote to memory of 3636 1764 9thnht.exe 100 PID 1764 wrote to memory of 3636 1764 9thnht.exe 100 PID 3636 wrote to memory of 4584 3636 vpdvp.exe 101 PID 3636 wrote to memory of 4584 3636 vpdvp.exe 101 PID 3636 wrote to memory of 4584 3636 vpdvp.exe 101 PID 4584 wrote to memory of 3012 4584 ddddp.exe 102 PID 4584 wrote to memory of 3012 4584 ddddp.exe 102 PID 4584 wrote to memory of 3012 4584 ddddp.exe 102 PID 3012 wrote to memory of 4724 3012 bhnhbb.exe 103 PID 3012 wrote to memory of 4724 3012 bhnhbb.exe 103 PID 3012 wrote to memory of 4724 3012 bhnhbb.exe 103 PID 4724 wrote to memory of 5084 4724 nnnhtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe"C:\Users\Admin\AppData\Local\Temp\793c269ade5d617bb59832f9230d0f97b808074cacce4f4dedd8c9a524f49bf2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\hnbbtn.exec:\hnbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\xfrlffx.exec:\xfrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\flxrlff.exec:\flxrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\rxrrllf.exec:\rxrrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\tnnnbt.exec:\tnnnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\fxlfrrl.exec:\fxlfrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\tntnnn.exec:\tntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\3rxxffl.exec:\3rxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tbhhhb.exec:\tbhhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xfrlrlr.exec:\xfrlrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jdpjp.exec:\jdpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\frxrffx.exec:\frxrffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\nbhhbh.exec:\nbhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\ppddd.exec:\ppddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\hbhhnn.exec:\hbhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vppdv.exec:\vppdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\9thnht.exec:\9thnht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\vpdvp.exec:\vpdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\ddddp.exec:\ddddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\bhnhbb.exec:\bhnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nnnhtt.exec:\nnnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\jvjdv.exec:\jvjdv.exe23⤵
- Executes dropped EXE
PID:5084 -
\??\c:\5rxrllf.exec:\5rxrllf.exe24⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bhhnhh.exec:\bhhnhh.exe25⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5vdvj.exec:\5vdvj.exe26⤵
- Executes dropped EXE
PID:4056 -
\??\c:\ntbtnn.exec:\ntbtnn.exe27⤵
- Executes dropped EXE
PID:4892 -
\??\c:\llfxrlf.exec:\llfxrlf.exe28⤵
- Executes dropped EXE
PID:3144 -
\??\c:\tbnhbt.exec:\tbnhbt.exe29⤵
- Executes dropped EXE
PID:4792 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe30⤵
- Executes dropped EXE
PID:444 -
\??\c:\dvddv.exec:\dvddv.exe31⤵
- Executes dropped EXE
PID:4700 -
\??\c:\lfllffx.exec:\lfllffx.exe32⤵
- Executes dropped EXE
PID:4220 -
\??\c:\dpvpv.exec:\dpvpv.exe33⤵
- Executes dropped EXE
PID:912 -
\??\c:\7rxlllr.exec:\7rxlllr.exe34⤵
- Executes dropped EXE
PID:424 -
\??\c:\tbhhnn.exec:\tbhhnn.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:224 -
\??\c:\ppvpj.exec:\ppvpj.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe37⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9thhbt.exec:\9thhbt.exe38⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe39⤵
- Executes dropped EXE
PID:1304 -
\??\c:\tbntbh.exec:\tbntbh.exe40⤵
- Executes dropped EXE
PID:4508 -
\??\c:\pdjdd.exec:\pdjdd.exe41⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pvjdp.exec:\pvjdp.exe42⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe43⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7tnhhb.exec:\7tnhhb.exe44⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pjpjp.exec:\pjpjp.exe45⤵
- Executes dropped EXE
PID:3756 -
\??\c:\lllxrrf.exec:\lllxrrf.exe46⤵
- Executes dropped EXE
PID:4420 -
\??\c:\rfrlffx.exec:\rfrlffx.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tntttb.exec:\tntttb.exe48⤵
- Executes dropped EXE
PID:4560 -
\??\c:\dpppv.exec:\dpppv.exe49⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe50⤵
- Executes dropped EXE
PID:1528 -
\??\c:\flrlxrl.exec:\flrlxrl.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\btnbnb.exec:\btnbnb.exe52⤵
- Executes dropped EXE
PID:4504 -
\??\c:\1pjdp.exec:\1pjdp.exe53⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3lfxllf.exec:\3lfxllf.exe54⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7lrflff.exec:\7lrflff.exe55⤵
- Executes dropped EXE
PID:3656 -
\??\c:\3tbtht.exec:\3tbtht.exe56⤵
- Executes dropped EXE
PID:3112 -
\??\c:\pjvjp.exec:\pjvjp.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe58⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbbnth.exec:\nbbnth.exe59⤵
- Executes dropped EXE
PID:1592 -
\??\c:\httnhb.exec:\httnhb.exe60⤵
- Executes dropped EXE
PID:4836 -
\??\c:\1vjjv.exec:\1vjjv.exe61⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxxrfxf.exec:\fxxrfxf.exe62⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5tnhtt.exec:\5tnhtt.exe63⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hbbthh.exec:\hbbthh.exe64⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jdjdd.exec:\jdjdd.exe65⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3ddvj.exec:\3ddvj.exe66⤵PID:3176
-
\??\c:\tnhnht.exec:\tnhnht.exe67⤵PID:2516
-
\??\c:\bhnhbn.exec:\bhnhbn.exe68⤵PID:1464
-
\??\c:\jvpdj.exec:\jvpdj.exe69⤵PID:4128
-
\??\c:\fxfxxfl.exec:\fxfxxfl.exe70⤵PID:1472
-
\??\c:\bbhthb.exec:\bbhthb.exe71⤵PID:2000
-
\??\c:\3pdvj.exec:\3pdvj.exe72⤵PID:4636
-
\??\c:\vvjdd.exec:\vvjdd.exe73⤵PID:4936
-
\??\c:\rlllffx.exec:\rlllffx.exe74⤵PID:244
-
\??\c:\thnbtn.exec:\thnbtn.exe75⤵PID:2620
-
\??\c:\jvvpd.exec:\jvvpd.exe76⤵PID:932
-
\??\c:\vjjdv.exec:\vjjdv.exe77⤵PID:1352
-
\??\c:\flrflfr.exec:\flrflfr.exe78⤵PID:1520
-
\??\c:\bntnnn.exec:\bntnnn.exe79⤵PID:3056
-
\??\c:\1pjdv.exec:\1pjdv.exe80⤵PID:2308
-
\??\c:\5jdvj.exec:\5jdvj.exe81⤵PID:2216
-
\??\c:\lfffrrr.exec:\lfffrrr.exe82⤵PID:4668
-
\??\c:\nthbnn.exec:\nthbnn.exe83⤵PID:4612
-
\??\c:\pjjdd.exec:\pjjdd.exe84⤵PID:4240
-
\??\c:\lfffxxf.exec:\lfffxxf.exe85⤵PID:4220
-
\??\c:\rrxrrll.exec:\rrxrrll.exe86⤵PID:3872
-
\??\c:\tbnhtt.exec:\tbnhtt.exe87⤵PID:1932
-
\??\c:\jdpjp.exec:\jdpjp.exe88⤵PID:3472
-
\??\c:\xxffrrl.exec:\xxffrrl.exe89⤵PID:2920
-
\??\c:\lfffxrr.exec:\lfffxrr.exe90⤵PID:1500
-
\??\c:\ttnhbb.exec:\ttnhbb.exe91⤵PID:4148
-
\??\c:\9dvpj.exec:\9dvpj.exe92⤵PID:2860
-
\??\c:\5xxfrrl.exec:\5xxfrrl.exe93⤵PID:4564
-
\??\c:\nhbtbt.exec:\nhbtbt.exe94⤵PID:1184
-
\??\c:\vvjvv.exec:\vvjvv.exe95⤵PID:1960
-
\??\c:\vpdvv.exec:\vpdvv.exe96⤵PID:3452
-
\??\c:\thnhbb.exec:\thnhbb.exe97⤵PID:3896
-
\??\c:\hhbttn.exec:\hhbttn.exe98⤵PID:2052
-
\??\c:\pdpjv.exec:\pdpjv.exe99⤵PID:2884
-
\??\c:\xflfxxx.exec:\xflfxxx.exe100⤵PID:2500
-
\??\c:\5bbtnn.exec:\5bbtnn.exe101⤵PID:4284
-
\??\c:\ntbbbh.exec:\ntbbbh.exe102⤵PID:3228
-
\??\c:\1jpdv.exec:\1jpdv.exe103⤵PID:2808
-
\??\c:\7xxrlfx.exec:\7xxrlfx.exe104⤵PID:3820
-
\??\c:\hbhbnh.exec:\hbhbnh.exe105⤵PID:2596
-
\??\c:\bnnhtn.exec:\bnnhtn.exe106⤵PID:3988
-
\??\c:\vvdvj.exec:\vvdvj.exe107⤵PID:2292
-
\??\c:\fxlffff.exec:\fxlffff.exe108⤵PID:2716
-
\??\c:\thnhbh.exec:\thnhbh.exe109⤵PID:2928
-
\??\c:\dvddp.exec:\dvddp.exe110⤵PID:1780
-
\??\c:\lrxrffx.exec:\lrxrffx.exe111⤵PID:1312
-
\??\c:\frrlffx.exec:\frrlffx.exe112⤵PID:2936
-
\??\c:\tttntt.exec:\tttntt.exe113⤵PID:2020
-
\??\c:\vppjd.exec:\vppjd.exe114⤵PID:4516
-
\??\c:\xllfrrl.exec:\xllfrrl.exe115⤵PID:4996
-
\??\c:\7htnbb.exec:\7htnbb.exe116⤵PID:2220
-
\??\c:\pjjdp.exec:\pjjdp.exe117⤵PID:3916
-
\??\c:\jvdvj.exec:\jvdvj.exe118⤵PID:5068
-
\??\c:\lxfxllf.exec:\lxfxllf.exe119⤵PID:4592
-
\??\c:\hbhhhh.exec:\hbhhhh.exe120⤵PID:2432
-
\??\c:\9hbthh.exec:\9hbthh.exe121⤵PID:4924
-
\??\c:\jvjdd.exec:\jvjdd.exe122⤵PID:1424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-